OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10 #2713

lennyphan · 2022-01-13T15:27:09Z

Online WLST cannot successfully connect to the Admin Server via k8s port-forward when the WebLogic domain is integrated with Istio versions prior to v1.10. The generated WebLogic network channels, specifically for use with Istio versions prior to v1.10, define a public listen address that is only resolvable within the k8s cluster and this prevents online WLST from successfully establishing a 't3' connection. Since Istio versions prior to v1.10 are not officially supported (have reached end-of-life), we are updating the documentation for Operator release 3.3.x to describe the additional network channel configuration needed to allow k8s port-forwarding to work when Istio version prior to v1.10 is integrated with the WebLogic domain.

rosemarymarano

minor edits

rosemarymarano · 2022-01-13T15:34:29Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+  configured with the following attributes:
+  * Protocol defined as `t3`.
+  * Listen address defined with `localhost`.
+  * Listen port. Note, you should choose a port value that does not conflict with any ports defined 


Note, you should choose a port -> Note: Choose a port

rosemarymarano · 2022-01-13T15:35:57Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+  * Enable `HTTP` protocol for this network channel.
+  * Do _NOT_ set an `external listen address` or `external listen port`.
+
+For example, here is a snippet of a WebLogic domain `config.xml` file for channel `PortForward` for the Admin Server


Period at the end of the sentence. -> ...for the Administration Server.

rosemarymarano · 2022-01-13T15:37:50Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+  </network-access-point>
+</server>
+```
+For Model in Image (MII) and Domain Home in Image (DII), here is a snippet model configuration for channel `PortForward` for the Admin Server


Domain Home in Image -> Domain in Image
Period at the end of the sentence. -> ...for the Administration Server.

tbarnes-us · 2022-01-13T16:54:58Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+  you must add an additional network channel to the WebLogic Administration Server 
+  configured with the following attributes:
+  * Protocol defined as `t3`.
+  * Listen address defined with `localhost`.


Have you tested this? I'm pretty sure the introspector WLST generates overrides for every configured listen address on every channel to force it to "DOMAINUID-WLSERVERNAME".

I did test it. This is only for when you are Istio enabled AND Istio versions prior to 1.10. In the introspector code, we customize naps to set the listen address to 'localhost/127.0.0.1' when Istio is enabled AND Istio requires localhost bindings:

def customizeNetworkAccessPoint(self, nap, listen_address):
# Don't bother 'add' a nap listen-address, only do a 'replace'.
# If we try 'add' this appears to mess up an attempt to
# 'add' PublicAddress/Port via custom sit-cfg.
# FWIW there's theoretically no need to 'add' or 'replace' when empty
# since the runtime default is the server listen-address.

istio_enabled = self.env.getEnvOrDef("ISTIO_ENABLED", "false") istio_use_localhost_bindings = self.env.getEnvOrDef("ISTIO_USE_LOCALHOST_BINDINGS", "true") if istio_enabled == 'true' and istio_use_localhost_bindings == 'true': listen_address = '127.0.0.1'

So technically, it doesn't matter what you set the listen address to? Why do the new instructions say to set "localhost"? We don't normally advise setting the LA to anything IIRC.

Yes, technically doesn't matter. I just added the instructions as it does match well in understanding why the channel has to bind listen address as 'localhost' when using Istio versions prior to v1.10 (i.e. istio proxying data to 'localhost'). I'm fine with removing the advice of setting the listen address to 'localhost', if that's the preference.

OK - now I get it - thanks. I guess it's fine, but I prefer something like:

Listen address defined with localhost. (Note that setting the address to localhost is solely for self documenting purposes. The address can be set to any value, and the operator will override it to the required value regardless.)

Pre-approving - leaving it up to you to add the additional wording.

ankedia · 2022-01-13T19:45:04Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

-  network channel with a `localhost` listen address for each
-  existing port. This means that no additional configuration is required
-  to enable port forwarding when Istio is enabled.
+  you must add an additional network channel to the WebLogic Administration Server 


Is the additional network channel still needed if user only wants to access console (and not WLST)? I think WLST use-case is not very common and we may want to mention about the additional channel only when WLST access is required.

Technically, it's not needed if user only wants to access using console. We can update the description to include if online WLST access is required. It is becoming very confusing with all these restrictions so I omitted it as the additional network channel works for both console and online WLST.

I prefer to be very exact - IMO, it's more confusing not to mention that this is only needed for WLST (but happens to work for console too) - especially as it's more convenient for those that just need console access to skip the extra "configure a NAP step". Please do include the extra wording.

tbarnes-us · 2022-01-13T19:50:47Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+  you must add an additional network channel to the WebLogic Administration Server 
+  configured with the following attributes:
+  * Protocol defined as `t3`.
+  * Listen address defined with `localhost`.


OK - now I get it - thanks. I guess it's fine, but I prefer something like:

Listen address defined with localhost. (Note that setting the address to localhost is solely for self documenting purposes. The address can be set to any value, and the operator will override it to the required value regardless.)

Pre-approving - leaving it up to you to add the additional wording.

lennyphan · 2022-01-13T21:29:47Z

I've made doc changes based on the latest input. Please review again and provide feedback. Thank you.

rosemarymarano

few edits

rosemarymarano · 2022-01-13T21:30:37Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

  configured with the following attributes:
  * Protocol defined as `t3`.
-  * Listen address defined with `localhost`.
+  * Listen address defined with `localhost`. (Note: Stting the address to localhost is solely 


typo -> Stting

rosemarymarano · 2022-01-13T21:31:01Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

  * Protocol defined as `t3`.
-  * Listen address defined with `localhost`.
+  * Listen address defined with `localhost`. (Note: Stting the address to localhost is solely 
+  for self documenting purposes. The address can be set to any value, and the operator will override 


self documenting -> self-documenting

rosemarymarano · 2022-01-13T21:32:09Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

-  * Listen address defined with `localhost`.
+  * Listen address defined with `localhost`. (Note: Stting the address to localhost is solely 
+  for self documenting purposes. The address can be set to any value, and the operator will override 
+  it to the required value regardless.)


unnecessary word -> regardless. You can remove it.

rosemarymarano · 2022-01-13T21:35:09Z

documentation/staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md

+It is not necessary to add an additional network channel, for Istio-enabled domains running Istio 
+versions prior to 1.10, to the WebLogic Administration Server if only console access is required .
+{{% /notice %}}
+


suggested re-write:
"For Istio-enabled domains running Istio
versions prior to 1.10, if console only access is required, then it is not necessary to add an additional network channel to the WebLogic Administration Server."

OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10

lennyphan added 2 commits January 12, 2022 06:57

Update documentation for port-forward for wlst

dad7455

Add example snippets for domain home types

62a4d01

lennyphan requested review from ankedia, rjeberhard, rosemarymarano and tbarnes-us January 13, 2022 15:27

rosemarymarano reviewed Jan 13, 2022

View reviewed changes

tbarnes-us reviewed Jan 13, 2022

View reviewed changes

first update based on review

4831cc3

rosemarymarano approved these changes Jan 13, 2022

View reviewed changes

ankedia reviewed Jan 13, 2022

View reviewed changes

tbarnes-us approved these changes Jan 13, 2022

View reviewed changes

add additional doc updates

b4e92f2

lennyphan requested review from ankedia, rosemarymarano and tbarnes-us January 13, 2022 21:28

rosemarymarano reviewed Jan 13, 2022

View reviewed changes

minor edits from review

81d3e8e

tbarnes-us approved these changes Jan 13, 2022

View reviewed changes

ankedia approved these changes Jan 13, 2022

View reviewed changes

robertpatrick merged commit a033d47 into release/3.3 Jan 13, 2022

robertpatrick deleted the OWLS-92959 branch January 13, 2022 21:55

OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10 #2713

OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10 #2713

Uh oh!

Conversation

lennyphan commented Jan 13, 2022

Uh oh!

rosemarymarano left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tbarnes-us Jan 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lennyphan commented Jan 13, 2022

Uh oh!

rosemarymarano left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tbarnes-us Jan 13, 2022 •

edited

Loading